Between the monthly briefs: vulnerabilities with a CVE that are on the CISA
KEV catalog or carry evidence of exploitation in the wild. This is the short list —
the things whose patch window has already closed.
Data as of 16 October 2026, 23:23 UTC ·
Source brief 2026-10-16Cadence checked weekdays — the date above moves only when a card changes, so an
old date means no card has changed since, not that nobody looked
Patch priority — 99 under active exploitation
Ranked in from the brief. Every entry here has a CVE and either a CISA KEV
listing or independent evidence of exploitation.
CVE-2026-102764CVSS 9.3Exploited
BeyondTrust Remote Support (RS), self-hosted, all versions <= 26.2.3 (SaaS patched 2026-10-09). Privileged Remote Access shares the code — patched as a precaution, no known exploit path
Improper origin validation in an internal messaging component (CWE-290, authentication bypass by spoofing) — unauthenticated remote file operations on the appliance, used for webshell upload and root
Exploitationyes — zero-day exploitation by ARMORY CASTLE (UNC5221) from 2026-08-29 against two Remote Support customers (BeyondTrust blog, last updated 2026-10-16; Mandiant/GTIG 2026-10-15); CISA KEV added 2026-10-16, ransomware use Unknown. Both vendors expect broad exploitation of unpatched appliances now the flaw is public
KEV added2026-10-16
CISA deadline2026-10-19
Patched inBT26-05-RS patch for Remote Support 24.3.1–26.2.3, applied from /appliance (automatic where subscribed); older than 24.3.1 — upgrade first, then patch. SaaS patched 2026-10-09. Self-hosted PRA: apply the PRA patch (precaution). Patching does NOT clear a compromise — hunt with Mandiant's IOCs/YARA, and rebuild + rotate credentials where compromise is confirmed or cannot be ruled out (advisory and blog read directly 2026-10-16)
Path traversal in the CLI (CWE-22) — authenticated read-write admin can write or delete arbitrary files; escalation of privilege
Exploitationyes — Fortinet FG-IR-26-122 shows 'Known Exploited: Yes' (no date or detail given); CISA KEV added 2026-10-16, ransomware use Unknown. Requires an authenticated admin with read-write permissions
KEV added2026-10-16
CISA deadline2026-10-19
Patched inFortiOS 7.6.5 / 7.4.10; FortiProxy 7.6.5 / 7.4.12; FortiPAM 1.7.1 (1.8 unaffected); FortiSwitchManager 7.2.8 / 7.0.7. FortiOS 7.2/7.0/6.4, FortiProxy 7.2/7.0 and FortiPAM 1.0–1.6: migrate to a fixed release. No workaround (FG-IR-26-122 read directly 2026-10-16)
Atlassian Data Center / self-managed: Jira Software, Jira Service Management, Confluence, Bitbucket, Bamboo, Crowd, Crucible, Fisheye — all versions below the fixed builds. Atlassian Cloud already patched
Path traversal — unauthenticated arbitrary file read within the web application root (exact path required; no directory listing)
Exploitationyes — CISA KEV listing added 2026-10-15 (forensic triage required, ransomware use Unknown); public PoC (watchTowr, 2026-10-06) and honeypot exploitation attempts (trade press, Previdian). Atlassian's advisory is unrevised and confirms no exploitation itself (Cloud: none found). CVE ID REJECTED by the CNA 2026-10-16 ('may have been a false positive or a mistake') while the advisory and the KEV entry still stand — watch for a replacement ID
KEV added2026-10-15
CISA deadline2026-10-18
Patched inJira Software 9.12.40 / 10.3.26 / 11.3.12; JSM 5.12.40 / 10.3.26 / 11.3.12; Confluence 9.2.26 / 10.2.19; Bitbucket 9.4.26 / 10.2.8 / 10.5.1; Bamboo 10.2.24 / 12.1.12; Crowd 6.3.7 / 7.0.3 / 7.1.7 / 7.2.4; Crucible and Fisheye 4.9.15 (Atlassian advisory, 2026-10-05, unrevised as of 2026-10-16). Interim: WAF/RewriteValve/urlrewrite blocks per the advisory and remove internet exposure. Cloud: no action
Ahsay AhsayCBS — CVE record: up to 10.3.2; vendor and Huntress: 10.3.4.0 and v9.15.2.59 also not fully fixed
OS command injection (CWE-78) in the Replication Receiver /rps/api/json/UpdateReceivers.do 'random' argument — remote code execution as SYSTEM, reached unauthenticated via CVE-2026-105133
Exploitationyes — Huntress observed exploitation from 2026-10-07 23:20 UTC (chained after CVE-2026-105133; SYSTEM command execution, webshells, XMRig); CISA KEV added 2026-10-14, ransomware use Unknown; CISA-ADP SSVC exploitation active, technical impact total
KEV added2026-10-14
CISA deadline2026-10-17
Patched inApply the AhsayCBS v10.3.4.45 hotfix (v10) or the v9.15.2.70 hotfix (v7/v8/v9), then reboot — Ahsay notice updated 2026-10-12, read directly 2026-10-15. ⚠️ NOT 10.3.4 (Ahsay: v10.3.4.0 'did not fully address' the flaws). Re-image hosts where IOCs are found
Cisco Secure Email Gateway (AsyncOS for ESA), physical and virtual — vulnerable when File Reputation (AMP) is enabled and assigned to a mail policy AND Content Scanner Tools < 25.3.0.5525. Not affected: Secure Email and Web Manager, Secure Web Appliance. Cloud Gateway mitigated by Cisco
Relative path traversal (CWE-23) in AMP attachment handling — unauthenticated arbitrary file write leading to root command execution, triggered by an inbound email
Exploitationyes — Cisco PSIRT 'became aware of active exploitation' in October 2026 (advisory 2026-10-14); CISA KEV added 2026-10-14 ('Cisco Secure Email Gateway Relative Path Traversal Vulnerability'), ransomware use Unknown. No actor named
KEV added2026-10-14
CISA deadline2026-10-17
Patched inAsyncOS 15.5.5-014 (15.5) or 16.5.0-780 (16.5); 16.0 has NO fix — migrate to 16.5.0-780 (Cisco recommends 16.5.0-780 for anything older than 16.5). Alternatively Content Scanner Tools 25.3.0.5525 or later, distributed to licensed appliances with no restart — apply manually where auto-update is off. No workarounds. Cloud Gateway: no action. After patching, check System Security logs on every cluster member (advisory read directly 2026-10-15)
Palo Alto Networks PAN-OS on PA-Series and VM-Series firewalls and Panorama (virtual and M-Series) — branches 10.2, 11.1, 11.2, 12.1, 12.2. Not affected: Cloud NGFW, Prisma Access
Code injection (CWE-94) in the management interface — authenticated attacker with network access executes code as root
Exploitationyes — Palo Alto: 'Very limited exploitation has been observed targeting the Palo Alto Networks management interface' (advisory 2026-10-14; CVSS exploit maturity ATTACKED); CISA KEV added 2026-10-14, ransomware use Unknown. No external research report found (SEARCHED, NOT FOUND)
KEV added2026-10-14
CISA deadline2026-10-17
Patched in12.2.4; 12.1.4-h12 / 12.1.7-h8 / 12.1.10-h2; 11.2.4-h22 / 11.2.7-h21 / 11.2.10-h15 / 11.2.13-h3 / 11.2.16; 11.1.4-h37 / 11.1.6-h39 / 11.1.7-h11 / 11.1.10-h35 / 11.1.13-h15 / 11.1.16-h3; 10.2.7-h38 / 10.2.10-h41 / 10.2.13-h26 / 10.2.16-h11 / 10.2.18-h12 (advisory JSON read directly 2026-10-15). No workarounds; Threat IDs 510046/510047 give limited coverage only with management traffic decrypted on a DP port. Restrict management access to a jump box / trusted IPs
Ahsay AhsayCBS — CVE record: up to 10.3.2; vendor and Huntress: 10.3.4.0 and v9.15.2.59 also not fully fixed. Affected v7/v8/v9/v10 lines per Ahsay's notice
Improper authentication (CWE-287) in the API checkSysPwd function — remote authentication bypass, chained with CVE-2026-105134 for unauthenticated SYSTEM command execution
Exploitationyes — Huntress observed exploitation from 2026-10-07 23:20 UTC against five organizations (blog 2026-10-08, updated 10-12), chained with CVE-2026-105134; CISA KEV added 2026-10-14, ransomware use Unknown; CISA-ADP SSVC exploitation active. Ahsay's notice does not state exploitation
KEV added2026-10-14
CISA deadline2026-10-17
Patched inApply the AhsayCBS v10.3.4.45 hotfix (v10) or the v9.15.2.70 hotfix (v7/v8/v9), then reboot — Ahsay notice updated 2026-10-12, read directly 2026-10-15. ⚠️ NOT 10.3.4: the CVE record, NVD CPE and KEV text treat 10.3.4 as fixed, but Ahsay says v10.3.4.0 and v9.15.2.59 'did not fully address' the flaws. Restrict the management interface to trusted IPs / VPN; re-image if IOCs are found (Huntress)
Microsoft Windows — Windows 10 1607 / 1809 / 21H2 / 22H2; Windows 11 23H2 / 24H2 / 25H2 / 26H1 / 26H2; Windows Server 2012 R2, 2016, 2019, 2022, 2025 (incl. Server Core). Server 2012 (non-R2) not listed
Security feature bypass — command injection (CWE-77) in Windows Shell lets a crafted file evade Mark of the Web; user interaction required
Exploitationyes — MSRC Exploited: Yes / Publicly Disclosed: No ('Exploitation Detected') at release 2026-10-13; CISA KEV added 2026-10-13 ('Microsoft Windows Command Injection Vulnerability'), forensic triage required, ransomware use Unknown. No actor named. NVD still carries a CISA-ADP SSVC 'exploitation none' entry dated 2026-10-08 that predates the KEV listing
KEV added2026-10-13
CISA deadline2026-10-16
Patched inOctober 13, 2026 security updates (fixed builds from the CVE record, KB map from MSRC CVRF; KB numbers confirmed by support.microsoft.com redirects 2026-10-14): Windows 11 24H2/25H2/26H2 KB5127648 (26100.9711 / 26200.9711 / 26300.9711); 26H1 KB5127646 (28000.3231); 23H2 KB5126653 (22631.7652); Windows 10 21H2/22H2 ESU KB5126657 (19044/19045.7807); 1809 + Server 2019 KB5126651 (17763.9376); 1607 + Server 2016 KB5126868 (14393.9612); Server 2022 KB5126655 (20348.5761); Server 2025 KB5126646 (26100.33650); Server 2012 R2 KB5126836 monthly rollup (6.3.9600.23470). No hotpatch listed
Ivanti Connect Secure — CISA: 25.1.1.1 and prior, 25.1.2.2 and prior, 22.8R2.4 and prior. CVE record unaffected: 25.1.3.0, 25.1.3.1, 22.8R2.5, 22.7R2.14 and earlier. Policy Secure / ZTA / Neurons not named in the CVE record
Authentication bypass by spoofing (CWE-290) + RCE via wu.cgi file write — unauthenticated command execution; chained with an UNFIXED dsinvoked/DSCache privilege escalation to root
Exploitationyes — exploited from 2026-10-03 by UTA0576 against a fully patched 22.8R2.4 appliance (Volexity, 2026-10-13); CISA alert 2026-10-13: zero-day used for credential theft and data exfiltration; CISA KEV added 2026-10-13, forensic triage required; CISA-ADP SSVC exploitation active
KEV added2026-10-13
CISA deadline2026-10-16
Patched inUpgrade to ICS 25.1.3.0 / 25.1.3.1, or 22.8R2.5 as an interim step (22.8 EOL 2027-01-31) — per the CVE record's unaffected list, read 2026-10-14. 🔴 PARTIAL: the privilege-escalation bug in the same chain has NO fix yet (Volexity relays Ivanti: 'working on a fix'). Ivanti advisory NOT read (JavaScript-only); a 25.1.1.2 fix for ISA6000/8000 is secondary-only. The Integrity Checker Tool does not detect this chain; follow CISA's recovery steps (backup config, factory reset + upgrade, restore, reset all passwords, reissue certificates/API keys/license-server credentials) if compromise is suspected
Missing authentication on mod_copy SITE CPFR/CPTO — unauthenticated arbitrary file read/write (CWE-284)
Exploitationyes — CISA KEV added 2026-10-08; joint advisory AA26-281A (2026-10-08) lists it among eight CVEs used for initial access by actors whose TTPs are 'consistent with the cyber activity publicly known as Flax Typhoon'
KEV added2026-10-08
CISA deadline2026-10-11
Patched inFixed upstream as Bug 4169 in ProFTPD 1.3.6rc1 (27 May 2015) and in distro security updates (Debian/openSUSE, per KEV notes); run a supported ProFTPD release. Interim: unload/remove mod_copy. KEV requires forensic triage — check exposed hosts for dropped files/web shells
Exploitationyes — CISA KEV added 2026-10-08; joint advisory AA26-281A (2026-10-08) lists it among eight initial-access CVEs used by Flax Typhoon–consistent actors
KEV added2026-10-08
CISA deadline2026-10-11
Patched inONLYOFFICE Document Server 5.6.3 and later (CHANGELOG 5.6.3: 'Fix Path Traversal vulnerability via image upload params (Bug #46113)'); run a current release. KEV requires forensic triage of exposed servers
ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 (and appliances bundling them)
Reachable assertion on TKEY query handling — unauthenticated remote denial of service of named
Exploitationyes — CISA KEV added 2026-10-08; joint advisory AA26-281A (2026-10-08) lists it among the eight CVEs used by Flax Typhoon–consistent actors
KEV added2026-10-08
CISA deadline2026-10-11
Patched inBIND 9.9.7-P2 / 9.10.2-P3 (ISC AA-01272, 2015) and every later release; run a supported BIND. Check appliances and embedded resolvers that bundle old named
Citrix NetScaler ADC and NetScaler Gateway 14.1 before 14.1-73.41, 13.1 before 13.1-64.28; NetScaler ADC 14.1-FIPS before 14.1-73.41 FIPS; NetScaler ADC 13.1-FIPS and 13.1-NDcPP before 13.1-37.282 — only when configured as SAML SP or SAML IdP; Secure Private Access hybrid NetScaler instances also affected; customer-managed only
CWE-119 memory overflow — unauthenticated denial of service against SAML SP/IdP-configured appliances
Exploitationyes — Citrix (companion blog, as quoted by Help Net Security and SecurityWeek): 'targeted attacks on unmitigated NetScaler deployments which can lead to Denial of Service'; CISA KEV added 2026-10-04; CISA-ADP SSVC exploitation: active. watchTowr assesses DoS-only and suspects use as a crash-to-assist step for CVE-2026-88771 exploitation (secondary, not asserted)
KEV added2026-10-04
CISA deadline2026-10-07
Patched inSUPERSEDED TARGET 2026-10-11: go to 14.1-73.46 / 13.1-64.29 / 14.1-73.46 FIPS / 13.1-37.283 FIPS-NDcPP, which also fix CVE-2026-107406 (CTX697191, 2026-10-08). Minimum for this CVE: ADC and Gateway 14.1 → 14.1-73.41; 13.1 → 13.1-64.28; ADC 14.1-FIPS → 14.1-73.41 FIPS; ADC 13.1-FIPS and 13.1-NDcPP → 13.1-37.282 (CTX697174, 2026-10-03). The September builds that fixed CVE-2026-88771/88772 do NOT fix this one. Precondition check: config contains 'add authentication samlAction' or 'add authentication samlIdPProfile'. 12.1 and 13.0 are EOL and not addressed. Because the crash may be paired with 88771 attempts, treat an unexplained reboot on a pre-September-build appliance as a CTX694799 compromise-triage trigger
Zammad GmbH — Zammad 6.3.0 to 6.5.x (exploitable; end of support); code present but not exploitable in 7.0.0–7.1.3 per DIVD and Zammad; hardened in 7.2.0
Session hijack / fixation leading to remote code execution as the zammad user (first stage of the DIVD-2026-00015 chain)
Exploitationyes — DIVD-2026-00015: the chain was 'abused to breach DIVD' on 2026-09-21; CISA KEV (added 2026-10-02, forensic triage required)
KEV added2026-10-02
CISA deadline2026-10-05
Patched inUpgrade to Zammad 7.x — 7.2.2 (2026-10-08) is the target: it also fixes CVE-2026-102490 in the DEB/RPM packages; hardening for this CVE is in 7.2.0+. 6.5 and older are end of support and receive no fix (6.5.4 does not close it); DIVD: upgrade to 7 or take the instance offline. Run DIVD's log-check script for IoCs
Zammad GmbH — Zammad DEB and RPM packages (packager.io), all released packaged versions <= 7.2.1 (GHSA-p97w-927q-8vxq, 2026-10-08); source installs and official container images NOT affected
Local privilege escalation from the zammad service user to root (second stage of the DIVD-2026-00015 chain)
Exploitationyes — DIVD-2026-00015: the chain was 'abused to breach DIVD' on 2026-09-21; CISA KEV (added 2026-10-02, forensic triage required). CISA-ADP SSVC on the CVE record still reads exploitation 'none' (stale vs KEV)
KEV added2026-10-02
CISA deadline2026-10-05
Patched inZammad 7.2.2 (GHSA-p97w-927q-8vxq, published 2026-10-08; vulnerable <= 7.2.1, DEB/RPM packages only). Upgrading to 7.2.2 also closes the remote stage CVE-2026-102489. Run DIVD's log-check script; treat a 6.x instance that was internet-exposed as possibly compromised to root
Fortinet FortiMail 8.0.0–8.0.1, 7.6.0–7.6.6, 7.4.0–7.4.8, 7.2.0–7.2.9 (per advisory FG-IR-26-175; the CVE record's affected list differs and also names 7.0.0–7.0.9)
CWE-22 path traversal + CWE-158 NULL-byte neutralization — unauthenticated arbitrary file write via crafted HTTP/HTTPS (IBE web path)
Exploitationyes — Fortinet FG-IR-26-175 (2026-10-01): 'This has been reported to be exploited in the wild', Known Exploited: Yes; CISA KEV (added 2026-10-01, forensic triage required); CISA-ADP SSVC exploitation: active
KEV added2026-10-01
CISA deadline2026-10-04
Patched in✅ FIXED (FG-IR-26-175 re-read 2026-10-14): upgrade 8.0.x to 8.0.2 or above, 7.6.x to 7.6.7 or above, 7.4.x to 7.4.9 or above; 7.2.x → move to the 7.4 branch (7.4.9+). FortiMail Cloud remediated 2026-10-05, no action. Until upgraded, apply a workaround: disable IBE (config system encryption ibe / set status disable / end) OR remove internet access to the webmail interface (trusted private networks only) OR WAF-block POST /ibe containing '../'. No virtual patch. Hunt the advisory's IPs (79.141.169.187, 45.129.0.192), cron/admin/archive-account log patterns and the reported file IOCs before and after mitigating
Cisco Catalyst SD-WAN Manager (vManage), all configurations — on-prem releases below the fixed builds; Cisco SD-WAN Cloud (Cisco Managed) fixed in 20.15.605 with no user action
CWE-177 improper handling of URL (hex) encoding — unauthenticated authentication bypass to the API as the admin user
Exploitationyes — Cisco advisory (2026-09-30): 'In September 2026, the Cisco PSIRT became aware of active exploitation'; CISA KEV (added 2026-09-30, forensic triage Yes); CISA-ADP SSVC exploitation: active
KEV added2026-09-30
CISA deadline2026-10-03
Patched in20.9 → 20.9.10.1; 20.12 → 20.12.8.2; 20.15 → 20.15.6.1; 20.18 → 20.18.4.1; 26.1 → 26.1.2.1; 26.2 → 26.2.1; earlier than 20.9 → migrate to a fixed release. Cisco-managed cloud: 20.15.605, no action. No workaround; on-prem interim mitigation = restrict SD-WAN Manager access to trusted networks (Cisco hardening guide). Hunt serviceproxy-access.log and vmanage-server.log per the advisory before and after upgrading
Apple iOS and iPadOS before 26.7.1 (iPhone 11 and later; iPad Pro 12.9-inch 3rd gen+, iPad Pro 11-inch 1st gen+, iPad Air 3rd gen+, iPad 8th gen+, iPad mini 5th gen+); macOS Sequoia before 15.8.1; macOS Tahoe before 26.7.1
CWE-787 out-of-bounds write in CoreGraphics — arbitrary code execution when processing a crafted file
Exploitationyes — Apple: aware of a report of possible exploitation in an extremely sophisticated attack against specific targeted individuals on iOS before iOS 27; CISA KEV (added 2026-09-29, forensic triage Yes); CISA-ADP SSVC exploitation: active. No actor named
KEV added2026-09-29
CISA deadline2026-10-13
Patched iniOS 26.7.1 / iPadOS 26.7.1, macOS Tahoe 26.7.1, macOS Sequoia 15.8.1 (all 2026-09-28). 27.x builds are outside the affected range. No fix published for the iOS 18.x line (XS/XR-class devices)
Citrix NetScaler ADC and NetScaler Gateway 14.1 and 13.1, NetScaler ADC 14.1-FIPS and 13.1-FIPS/NDcPP — customer-managed only; Citrix-managed cloud and Adaptive Authentication are patched by Cloud Software Group
Exploitationyes — Citrix CTX697096: exploitation observed on unmitigated deployments; CISA KEV (added 2026-09-27, forensic triage Yes); CISA-ADP SSVC exploitation: active. 'Exploited for weeks' and public-PoC claims are secondary and unverified — not asserted
KEV added2026-09-27
CISA deadline2026-09-30
Patched inADC and Gateway 14.1 → 14.1-73.37; 13.1 → 13.1-64.23; ADC 14.1-FIPS → 14.1-73.37 FIPS; ADC 13.1-FIPS and 13.1-NDcPP → 13.1-37.279 (CTX697096). 12.1 and 13.0 are EOL, not addressed by the bulletin — no fix. After upgrading, treat pre-patch exposure as possible compromise: CTX694799 response steps
Citrix NetScaler ADC and NetScaler Gateway 14.1 and 13.1, NetScaler ADC 14.1-FIPS and 13.1-FIPS/NDcPP, with DTLS enabled (default on VPN vservers) — customer-managed only
Pre-authentication memory overflow in DTLS handshake reassembly (CWE-119 per NVD; the CNA record carries no CWE) — RCE or denial of service
CWE-98 PHP file inclusion — get_page_template() resolves an attacker-chosen readable local .php outside the theme directories; RCE when the theme has a page-* top-level directory and a usable target (e.g. pearcmd.php with register_argc_argv) exists
Exploitationyes — CISA KEV (added 2026-09-25); CISA-ADP SSVC exploitation: active; Patchstack observed probing from 2026-09-22 11:49 UTC and pearcmd config-create file writes by 2026-09-23
KEV added2026-09-25
CISA deadline2026-09-28
Patched inWordPress 7.1.2 (2026-09-22) and backports: 7.0.6, 6.9.9, 6.8.10, 6.7.9, 6.6.9, 6.5.12, 6.4.12, 6.3.12, 6.2.13, 6.1.14, 6.0.16, 5.9.18, 5.8.17, 5.7.19, 5.6.21, 5.5.22, 5.4.23, 5.3.25, 5.2.28, 5.1.26, 5.0.29, 4.9.33, 4.8.32, 4.7.37. NOTE: 7.1.1 and its backports (the CVE-2026-93485 fix) are NOT sufficient. Interim: disable register_argc_argv, remove or restrict pearcmd.php, check the active theme for page-* directories
Microsoft SharePoint Server — Subscription Edition, 2019, Enterprise Server 2016 (per MSRC). SharePoint 2013: researcher claims affected, MSRC does not list it, out of support
Exploitationyes — Microsoft MSRC revision 1.2 (2026-09-25): 'reliable evidence of observed attacks'; CISA KEV (added 2026-09-25); Canadian Centre for Cyber Security AL26-023 (2026-09-24): aware of active exploitation; Previdian sensor observations from ~12:00 UTC 2026-09-24. MSRC's structured Exploited flag still reads No
KEV added2026-09-25
CISA deadline2026-09-28
Patched inAugust 2026 security updates (released 2026-08-11), re-read from the MSRC update-guide API 2026-09-25, unchanged: Subscription Edition KB5002893 (build 16.0.19725.20522); 2019 KB5002894 / KB5002896 (16.0.10417.20198); Enterprise Server 2016 KB5002905 / KB5002906 (16.0.5565.1001). MSRC: install all listed updates. If they were not installed before 2026-09-24, also hunt for compromise (sphealth.aspx or unfamiliar files under /_layouts/15/, suspicious Web Part markup and encoded XAML); Cyber Centre adds AMSI Full Mode, limiting exposure, and admin MFA
CWE-841 improper enforcement of behavioral workflow — SSH pre-authentication rekey drops into the connection protocol, allowing unauthenticated session/exec; entry point for the CVE-2026-86060 admin-takeover chain
Exploitationyes — CISA KEV (added 2026-09-25); CISA-ADP SSVC exploitation: active; CERT Polska confirmed exploitation of the chain from at least 2026-09-02 (privileged user 'ops' created)
KEV added2026-09-25
CISA deadline2026-09-28
Patched inRouterOS 6.49.21 (Long-term), 7.23.4 (Long-term), 7.24.2 (Stable), 7.25beta3 — same builds as CVE-2026-86060. For the full September batch take 7.23.6 / 7.24.3 (CERT.PL: CVE-2026-67278 incomplete in 7.23.4/7.24.2). Mitigation: no SSH from untrusted networks (VPN-only management); after upgrading check for unknown users (e.g. 'ops'), scripts and config, and search logs for 'user -2'
WSO2 API Manager 4.1.0–4.6.0, API Control Plane 4.5.0/4.6.0, Traffic Manager 4.5.0/4.6.0, Universal Gateway 4.5.0/4.6.0
CWE-347 improper signature verification — JWT algorithm mismatch accepted, unauthenticated token forgery → administrative account takeover (NOT path traversal/file upload as the KEV entry text states)
Exploitationyes — CISA KEV (added 2026-09-24); CISA-ADP SSVC exploitation: active; watchTowr observed forged-JWT attempts from 2026-09-13 and confirmed the bypass by replay (SecurityWeek 2026-09-16). No WSO2 exploitation statement
KEV added2026-09-24
CISA deadline2026-09-27
Patched inWSO2-2026-5328 (2026-05-03), fixed at update level: API Manager 4.6.0 U21, 4.5.0 U57, 4.4.0 U72, 4.3.0 U108, 4.2.0 U197, 4.1.0 U257; API Control Plane 4.6.0 U22, 4.5.0 U58; Traffic Manager 4.6.0 U21, 4.5.0 U56; Universal Gateway 4.6.0 U21, 4.5.0 U57. Open-source users: apply wso2/carbon-apimgt#13752 and wso2/product-apim#14167 or migrate to an unaffected version. No workaround published. API Manager below 4.1.0: status unknown per the CVE record
CWE-863 incorrect authorization — unauthenticated customer session switching to another customer's account (account takeover, customer data exposure)
Exploitationyes — CISA KEV (added 2026-09-24); CISA-ADP SSVC exploitation: active; Sansec reported blocking exploitation attempts within ~2 days of the 2026-08-11 release (SecurityWeek 2026-08-13). Adobe stated no known exploitation at release
KEV added2026-09-24
CISA deadline2026-09-27
Patched inAPSB26-92 (2026-08-11), delivered as isolated patches per Adobe KB ka-40380: apply the August 2026 isolated patch for your line on top of the latest -p release. Affected per Adobe KB: 2.4.9, 2.4.8-p5 and earlier, 2.4.7-p10, 2.4.6-p15, 2.4.5-p17, 2.4.4-p18 and earlier; Commerce B2B 1.3.3–1.5.3 and Magento Open Source 2.4.6–2.4.9 (-2026-jul builds) fixed in the matching -2026-aug builds (CVE record)
Arista — VeloCloud Orchestrator (VCO), ON-PREMISES only. Affected: 5.2.3.15 and below; 6.1.3.7 and below; 6.4.2.7 and below; 7.0.0.2 and below. Hosted and Dedicated VCO instances were impacted and have ALREADY been patched by Arista
Improper input validation allowing a remote attacker to access privileged internal functionality and impact the VCO host → compromise of the orchestrator and the data it manages
ExploitationYES — vendor-confirmed. Arista security advisory 0183 (read 2026-09-23): the issue 'was discovered externally and is known to be actively exploited.' Also CISA KEV, added 2026-09-22, federal deadline 2026-09-25 (catalog v2026.09.22). Exploitation requires certificate-based authentication from VeloCloud Edge to Orchestrator to be configured, plus network access to the VCO web interface
KEV added2026-09-22
CISA deadline2026-09-25
Patched inPARTIAL — read from Arista security advisory 0183 on 2026-09-23. FIXED: VCO 5.2.3.16 and later in the 5.2.3 train; VCO 6.4.2.8 and later in the 6.4.2 train. 🔴 NO FIXED VERSION IS STATED for the 6.1.x train (6.1.3.7 and below affected) or the 7.0.x train (7.0.0.2 and below affected) — operators on those trains have no published upgrade target and should contact Arista TAC. Hosted/Dedicated VCO already patched by Arista; on-premises must upgrade. MITIGATIONS until patched: restrict web-interface access to trusted administrative networks, monitor for suspicious outbound activity, review administrator logs for unexpected changes
Check Point Quantum Security Gateway and Spark Firewall (locally and centrally managed) — R80 through R82.10 inclusive, EXCLUDING R82.20; named: R81.20, R82, R82.10 and legacy end-of-support releases
Improper certificate trust validation during VPN negotiation → unauthenticated remote code execution on the Gateway
ExploitationYES — vendor-confirmed. Check Point security blog (read 2026-09-23): 'Starting September 12, 2026, we observed a wave of exploitation attempts against Spark customers', using certificate subjects CN=vpn / CN=vpn-user / CN=vpnuser and variants. Also CISA KEV, added 2026-09-22, federal deadline 2026-09-25 (catalog v2026.09.22). SUPERSEDES this item's previous 'no evidence' text, which was written 2026-09-16 against KEV v2026.09.14 and was still on the public card after the 2026-09-22 automated kev --fix flipped the flag but could not touch the prose
KEV added2026-09-22
CISA deadline2026-09-25
Patched inTwo vendor paths, read from Check Point sk1000117 on 2026-09-16. RECOMMENDED — LivePatch: BUNDLE_URGENT_SECURITY_UPDATE_R82_10_AUTOUPDATE Take 26, BUNDLE_URGENT_SECURITY_UPDATE_R82_AUTOUPDATE Take 26, BUNDLE_URGENT_SECURITY_UPDATE_R81_20_AUTOUPDATE Take 26. ALTERNATIVE — Jumbo Hotfix Accumulator: R82.10 Take 44 or later, R82 Take 126 or later, R81.20 Take 166 or later, R81.10 Take 190 or later. Spark Firewall: R82.00.10 Build 2325 or later, R81.10.17 Build 4968 or later. WORKAROUND if patching must wait: manually disable VPN implied rules and create explicit access-control rules restricting UDP/500, UDP/4500, TCP/443 and TCP/80 to specific peer IPs
Check Point — Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, SmartEvent. Affected: R82.20; R82.10 Jumbo Take 44 or lower; R82 Jumbo Take 126 or lower; R81.20 Jumbo Take 166 or lower; R81.10 Jumbo Take 190 or lower (EoS); R80/R80.10/R80.20/R80.30/R80.40/R81 (all EoS). NOT affected: Check Point Firewall Appliances, Spark Firewall, Smart-1 Cloud (fix already applied)
Directory traversal + file upload on the Management Web Service → unauthenticated arbitrary script execution on the Management Server
ExploitationYES — vendor-confirmed. Check Point sk1000171 (read 2026-09-23): 'This vulnerability is exploited in the Wild. Check Point is aware of a handful of customers who have been attacked.' Check Point's security blog dates the pinpointed attacks to 2026-07-23, two months before the KEV listing. Also CISA KEV, added 2026-09-22, federal deadline 2026-09-25 (catalog v2026.09.22)
KEV added2026-09-22
CISA deadline2026-09-25
Patched inRead from Check Point sk1000171 on 2026-09-23. R82.20: apply the R82.20 Security Hotfix (TAR). Jumbo Hotfix Accumulator — R82.10 from Take 45, R82 from Take 127, R81.20 from Take 170, R81.10 from Take 192. WARNING: these takes are HIGHER than the CVE-2026-85102 fix takes (44/126/166/190) — patching for CVE-2026-85102 does NOT fix this. NO LIVEPATCH EXISTS for this issue; sk1000171 states LivePatch Take 28/29 does not address it and that a LivePatch is not available 'because of the nature of the fix'. Interim mitigation: restrict TCP/19009 to trusted IPs; place Management behind a gateway and limit Trusted Clients to internal addresses. These Jumbo takes also include the fix for CVE-2026-91843 (sk1000155)
F5 — BIG-IP APM only. Affected branches: 21.x (21.1.0), 17.x (17.5.0-17.5.1 and 17.1.0-17.1.3). Evaluated NOT vulnerable: BIG-IP Next CNF, BIG-IP Next for Kubernetes, BIG-IP all other modules, BIG-IQ Centralized Management, F5 Distributed Cloud, NGINX One Console, NGINX all products, F5OS/F5OS-A/F5OS-C, F5 AI Gateway
CWE-122 heap-based buffer overflow in APM OAuth → unauthenticated remote code execution (data plane only; no control plane exposure). Present ONLY where APM is configured as an OAuth Authorization Server
ExploitationYES — vendor-confirmed. F5 K000162605 (read 2026-09-23) states: 'Important: We have learned that this vulnerability has been exploited.' Also CISA KEV, added 2026-09-22, federal deadline 2026-09-25 (catalog v2026.09.22). No public telemetry or exploitation write-up was located by this pass beyond the vendor statement and the catalog — SEARCHED, NOT FOUND
KEV added2026-09-22
CISA deadline2026-09-25
Patched inEngineering hotfixes ONLY, read from F5 K000162605 on 2026-09-23 — these are EHF .iso images from F5 Downloads, NOT ordinary point releases. BIG-IP APM 21.x: Hotfix-BIGIP-21.1.0.2.0.30.22-ENG.iso. BIG-IP APM 17.x: Hotfix-BIGIP-17.5.1.9.0.160.12-ENG.iso and Hotfix-BIGIP 17.1.3.5.0.41.14-ENG.iso. The EHFs contain all fixes in BIG-IP Hardened Releases 2 (HR2). SCOPING: deployments using APM strictly as an OAuth Client / Resource Server, without OAuth authorization server profiles configured, are not affected and need no action. Appliance mode IS vulnerable. Use F5 iHealth to confirm the running version
Zyxel — GS1900 series smart-managed switches. TEN models affected per the vendor advisory: GS1900-8, GS1900-8HP, GS1900-10HP, GS1900-16, GS1900-24, GS1900-24E, GS1900-24EP, GS1900-24HPv2, GS1900-48, GS1900-48HPv2. NVD's description names only GS1900-48HPv2 — the vendor table is broader and is authoritative
Stack-based buffer overflow in the CGI program → LAN-based unauthenticated OS command execution via a crafted HTTP request
ExploitationYES — real telemetry. GreyNoise documented roughly 996 compromised GS1900 switches across 48 countries, exploitation around 2026-08-17, first publicly documented 2026-09-17: a PyArmor-obfuscated Python exploit targeting GS1900-24 firmware 2.10-2.90, post-exploitation TFTP collector retrieving configurations, hashed root credentials and networking information staged to /home/web/tmp/info.txt. Also CISA KEV, added 2026-09-21, federal deadline 2026-09-24. NOTE: Zyxel's own advisory does NOT claim in-the-wild exploitation — the exploitation evidence is GreyNoise telemetry plus the catalog, and the vendor advisory predates it (2026-06-16)
KEV added2026-09-21
CISA deadline2026-09-24
Patched inRead from the Zyxel advisory on 2026-09-23 — per-model, and every model needs its own firmware. GS1900-8: 2.90(AAHH.1)C0 and earlier -> 2.90(AAHH.2)C0. GS1900-8HP: 2.90(AAHI.1)C0 and earlier -> 2.90(AAHI.2)C0. GS1900-10HP: 2.90(AAZI.1)C0 and earlier -> 2.90(AAZI.2)C0. GS1900-16: 2.90(AAHJ.1)C0 and earlier -> 2.90(AAHJ.2)C0. GS1900-24: 2.90(AAHL.1)C0 and earlier -> 2.90(AAHL.2)C0. GS1900-24E: 2.90(AAHK.1)C0 and earlier -> 2.90(AAHK.2)C0. GS1900-24EP: 2.90(ABTO.1)C0 and earlier -> 2.90(ABTO.2)C0. GS1900-24HPv2: 2.90(ABTP.1)C0 and earlier -> 2.90(ABTP.2)C0. GS1900-48: 2.90(AAHN.1)C0 and earlier -> 2.90(AAHN.2)C0. GS1900-48HPv2: 2.90(ABTQ.1)C0 and earlier -> 2.90(ABTQ.2)C0. INCIDENT NOTE: on any switch suspected compromised, patching is not sufficient — configurations and hashed root credentials were exfiltrated in the observed campaign, so rotate credentials and review the config for attacker changes
Linux — kernel, kTLS (tls) receive path. Versions below 6.0 unaffected per the Linux CNA
Improper check for unusual or exceptional conditions — mishandling of zero-length records on the kTLS rx_list after zero-copy decrypt
ExploitationCatalog-only. CISA KEV added 2026-09-18, federal deadline 2026-09-21 (PASSED). No vendor in-the-wild statement, exploit write-up or telemetry corroborating exploitation was located by this pass — SEARCHED, NOT FOUND. Recorded as a gap, not as corroboration
KEV added2026-09-18
CISA deadline2026-09-21
Patched inUpstream stable fix points read from the Linux CNA record via the CVE Services API on 2026-09-23: 6.1.149, 6.6.103, 6.12.44, 6.16.4, plus mainline. Kernel versions below 6.0 are unaffected. DISTRIBUTION KERNELS CARRY THEIR OWN VERSION NUMBERS and backport fixes — do not string-compare these upstream numbers against a distro kernel; map to your distribution's advisory. Debian LTS published an announcement and Siemens ProductCERT issued SSA-032379 for affected Siemens products (both linked). SCOPING: the vulnerable path requires kernel TLS (kTLS) to be in use
Linux kernel — netfilter bridge ebtables SNAT target (ebt_snat). Affected from 5.10; versions prior to 5.10 are NOT affected
Out-of-bounds write — the optional ARP sender-hardware-address rewrite calls skb_store_bits() into a range that skb_header_pointer() made readable but not writable, so a nonlinear skb fragment backed by a splice-imported file page is written through directly
Exploitationyes per CISA KEV — added 2026-09-18, federal deadline 2026-09-21, known ransomware campaign use: Unknown. ⚠️ The catalog is the sole basis for this field: no vendor exploitation statement, no public technical write-up and no telemetry corroborating in-the-wild use was located in this pass. SEARCHED, NOT FOUND — recorded as a gap rather than presented as corroborated
KEV added2026-09-18
CISA deadline2026-09-21
Patched inFixed in 5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.94, 6.18.36, 7.0.13 and mainline 7.1 — read from the Linux CNA's published CVE record 2026-09-18. Kernels prior to 5.10 are unaffected. SCOPING NOTE: the vulnerable path requires ebtables SNAT on a bridge WITH the optional ARP sender-hardware-address rewrite configured, which is bridging/virtualisation and container-host territory rather than a default server configuration — inventory for that configuration before treating every Linux host as in scope. Distribution kernels carry their own version numbers; map these upstream stable versions to your distribution's advisory rather than comparing strings
Linux kernel — crypto user-space API (af_alg / AF_ALG sockets), af_alg_sendmsg. Introduced in 2.6.38; affected until the stable releases listed below
Race condition — concurrent writes to the same af_alg socket interleave and can leave internal socket state inconsistent; reachable by any local process able to open an AF_ALG socket, which is unprivileged on a stock kernel
Exploitationyes per CISA KEV — added 2026-09-18, federal deadline 2026-09-21, known ransomware campaign use: Unknown. ⚠️ The catalog is the sole basis: no vendor exploitation statement, public exploit analysis or telemetry was located in this pass. SEARCHED, NOT FOUND. Note the tension worth recording — NVD scores this availability-only, and a pure denial-of-service race is an unusual KEV entry, which is itself weak evidence that the practical impact exceeds NVD's reading
KEV added2026-09-18
CISA deadline2026-09-21
Patched inFixed in 5.10.245, 5.15.194, 6.1.154, 6.6.108, 6.12.49, 6.16.9 and mainline 6.17 — read from the Linux CNA's published CVE record 2026-09-18. The defect dates to 2.6.38, so any kernel in service that predates the relevant stable release is affected; this is an old-fleet problem, not a new-kernel one. Where AF_ALG is not required, restricting or disabling the algif modules removes the attack surface independently of the kernel version. Distribution kernels carry their own version numbers — map these upstream stable versions to your distribution's advisory rather than comparing strings
Authentication bypass — insufficient authentication control on an API endpoint, reachable pre-auth, leading to administrative/root-level access
Exploitationyes — Cisco PSIRT states in advisory cisco-sa-ISE-ABP-VNSW7Tn5 (published 2026-09-16) that it is aware of active exploitation of this vulnerability. Independently listed on CISA KEV the same day. Neither source discloses actor, volume or first-observed date
KEV added2026-09-16
CISA deadline2026-09-19
Patched inCisco ISE 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7, 3.5 Patch 4. NO WORKAROUND exists; Cisco offers only a temporary mitigation — infrastructure access control lists restricting management traffic to the affected device. Advisory version 1.0 Final, published and last updated 2026-09-16
Google Pixel — cellular modem (Modem component); fixed at Android security patch level 2026-09-05
Improper authorization / permission bypass from a logic error in the cellular modem — remote (proximal/adjacent) elevation of privilege, no user interaction, no additional execution privileges
Exploitationyes — the Google Pixel Update Bulletin for September 2026 (published 2026-09-15) states there are indications that CVE-2026-58704 may be under limited, targeted exploitation. Note the vendor's own hedge: 'indications' and 'may be', not a confirmed campaign. CISA KEV listed it 2026-09-16, which is a firmer assertion than the vendor's wording
KEV added2026-09-16
CISA deadline2026-09-19
Patched inAndroid security patch level 2026-09-05 or later. ⚠️ A device reporting patch level 2026-09-01 does NOT carry this fix — the September bulletin has two patch-level strings and this CVE is in the later one. Verify the reported patch level on the handset rather than assuming 'September update installed' is sufficient. No workaround; modem fixes ship only in the firmware update
Acronis Backup plugin for cPanel & WHM (Linux) before build 1.9.3.1021; Acronis Backup extension for Plesk (Linux) before build 1.8.11.638
Local privilege escalation via insecure file permissions (CWE-276) — low-privileged local account to elevated/arbitrary code execution on Linux
Exploitationyes — Acronis advisory SEC-10986 states exploitation detected in the wild in limited, targeted attacks against Acronis Backup plugin for cPanel & WHM deployments. The vendor reports NO signs of active exploitation on Plesk deployments — the exploitation claim is product-specific and should not be generalised across both integrations. CISA KEV listed it the same day. No actor, technique, volume or start date disclosed
KEV added2026-09-16
CISA deadline2026-09-19
Patched incPanel & WHM: version 1.9.3 HF3 (update UPD-2609-3d72-20a7). Plesk: version 1.8.11 (update UPD-2609-efb0-50b2). Both updates were published before the advisory. No workaround is offered. Because the flaw is insecure file permissions, review affected hosts for evidence of prior privilege escalation rather than assuming the update closes a window that was never entered
Cisco AsyncOS Software for Cisco Secure Email Gateway — physical and virtual appliances, all affected configurations
Injection in email parsing (crafted SQL statements in a message) → unauthenticated remote command execution as root
Exploitationyes — Cisco PSIRT states it became aware of active exploitation in September 2026. CISA KEV added 2026-09-14, federal deadline 2026-09-17, known ransomware use: Unknown
KEV added2026-09-14
CISA deadline2026-09-17
Patched inAsyncOS 15.5.5-0141 (for 15.5 and earlier), 16.0.4-3021 (for 16.0), 16.5.0-780 (for 16.5; Cisco's recommended migration target) — read from the Cisco advisory 2026-09-16. Cisco states there are NO workarounds that address this vulnerability. Cisco also recommends checking every device in a cluster, not just one
GitLab — Community Edition and Enterprise Edition, self-managed. GitLab.com and GitLab Dedicated already patched
Path traversal (CNA: CWE-22; KEV lists CWE-35) plus missing authentication in the repository commits API → unauthenticated arbitrary file read
ExploitationYes — CISA KEV added 2026-09-11, federal deadline 2026-09-14 (PASSED). GitLab's release notes cite the KEV listing and publish three detections for exploitation attempts, and GitLab's detection write-up states public exploits exist (trailing-slash + percent-encoding route bypass). No telemetry volume figure was located by this pass — SEARCHED, NOT FOUND
KEV added2026-09-11
CISA deadline2026-09-14
Patched inGitLab 19.3.2, 19.2.6 and 19.1.8 (critical patch release, 2026-09-10), read from GitLab's release notes on 2026-09-23. Affected: 18.7 before 19.1.8, 19.2 before 19.2.6, 19.3 before 19.3.2; versions before 18.7 unaffected per the CNA record. The upgrade includes database migrations — single-node instances take downtime; multi-node can use zero-downtime procedures. PATCHING DOES NOT UNDO A SECRET THEFT: if an affected instance was internet-reachable and unpatched, hunt api_json.log with GitLab's three detections and rotate gitlab-secrets.json / secret key base, database and configured LDAP/SMTP/object-storage credentials on any hit (our recommendation, based on GitLab's own description of what the read exposes)
ConnectWise ScreenConnect — client prior to 26.6.5. ScreenConnect servers are explicitly NOT impacted per the vendor bulletin
Improper privilege management / missing authorization → files transferred and executed through an active remote session without Host confirmation
Exploitationyes per CISA KEV (added 2026-09-11, deadline 2026-09-14, known ransomware use: Unknown). ⚠️ The vendor bulletin does NOT claim in-the-wild exploitation — it rates the issue Priority 1 (High) using risk-of-targeting language. Vendor/catalog disagreement recorded, not resolved
KEV added2026-09-11
CISA deadline2026-09-14
Patched inScreenConnect 26.6.5 (vendor bulletin 2026-09-08, read 2026-09-11). Interim mitigation where the update cannot be applied at once: deselect the TransferFiles permission for all user roles under Administration > Security > Roles — the vendor states this 'may reduce exposure until the update is applied', i.e. mitigation, not a fix
Incorrect authorization — token validation checks the signature/issuer but not the token's scope, allowing privilege escalation
Exploitationyes per CISA KEV (added 2026-09-11, federal deadline 2026-09-25, known ransomware use: Unknown). JFrog's advisory does not itself state in-the-wild exploitation
KEV added2026-09-11
CISA deadline2026-09-25
Patched inJFrog Artifactory 7.133.11 — from JFrog's security advisories page, read 2026-09-11 (advisory published and updated 2026-07-27). No workaround is offered; upgrade is the remediation. Supply-chain follow-up: review artifact pushes and token issuance during the exposure window, since a patch does not un-publish a poisoned artifact
Improper authentication — an internal anonymous-user token can be returned to an unauthenticated caller while anonymous access is disabled
Exploitationyes per CISA KEV (added 2026-09-11, federal deadline 2026-09-25, known ransomware use: Unknown). JFrog's advisory does not itself state in-the-wild exploitation
KEV added2026-09-11
CISA deadline2026-09-25
Patched inPer-train fixes from JFrog's security advisories page, read 2026-09-11 — 7.111.20 · 7.117.27 · 7.125.19 · 7.133.28 · 7.146.8 (advisory published 2026-08-12, updated 2026-08-13). No workaround. ⚠️ Different fix line from CVE-2026-42016 (7.133.11) in the same 7.133 train — verify the exact build against BOTH advisories, and rotate tokens that could have been disclosed while the instance was vulnerable
MikroTik RouterOS — fixed in 6.49.21 (Long-term), 7.23.4 (Long-term), 7.24.2 (Stable), 7.25 beta 3; earlier builds in those trains affected. Vendor states 'Most configurations are not at risk' without enumerating which
Improper neutralization of argument delimiters in a command — a username beginning with a prohibited character alters the trusted RouterOS policy mask via the SSH login helper, leading to privilege escalation
Exploitationyes — MikroTik's own advisory (2026-09-03) states the vulnerabilities are actively exploited and withholds technical detail to allow time to update. CISA KEV added 2026-09-10, federal deadline 2026-09-13, known ransomware use: Unknown
KEV added2026-09-10
CISA deadline2026-09-13
Patched inUPDATE TARGET (amended 2026-09-25): RouterOS 7.23.6 (Long-term) or 7.24.3 (Stable) on 7.x; 6.49.21 (Long-term) on 6.x. This CVE itself is fixed in 6.49.21, 7.23.4, 7.24.2 and 7.25 beta 3 (MikroTik advisory read 2026-09-11), but companion CVE-2026-67278 in the same batch (7.x only) is fixed only in 7.23.6 / 7.24.3 per CERT Polska (read 2026-09-25). VENDOR MITIGATION where an update cannot be applied at once: ensure SSH is not open to any untrusted network; preferably expose no management ports and reach the device over a VPN such as WireGuard. Exploitation requires an unauthenticated SSH session to the login helper, so removing that reachability removes the attack path
MikroTik RouterOS — fixed in 6.49.21 (Long-term), 7.23.4 (Long-term), 7.24.2 (Stable), 7.25 beta 3; earlier builds in those trains affected
Missing authentication for a critical function — a 'related' btest connection is accepted before the primary session authenticates; with random-data=false the sender leaks an uninitialized kernel packet-buffer tail, and an unchecked inverted packet-size interval causes unsigned integer underflow, oversized fragmented output and a kernel restart
Exploitationyes — MikroTik's advisory (2026-09-03) states the September vulnerabilities are actively exploited. CISA KEV added 2026-09-10, federal deadline 2026-09-13, known ransomware use: Unknown
KEV added2026-09-10
CISA deadline2026-09-13
Patched inUPDATE TARGET (amended 2026-09-25): RouterOS 7.23.6 (Long-term) or 7.24.3 (Stable) on 7.x; 6.49.21 (Long-term) on 6.x. This CVE itself is fixed in 6.49.21, 7.23.4, 7.24.2 and 7.25 beta 3 — the SAME builds that fix CVE-2026-86060 — but companion CVE-2026-67278 (7.x only) is fixed only in 7.23.6 / 7.24.3 per CERT Polska (read 2026-09-25). Vendor mitigation as above: do not expose management/bandwidth-test services to untrusted networks; prefer VPN-only management access
Cisco Secure Firewall Management Center (FMC) Software and Security Cloud Control (SCC) Firewall Management — trains 7.0, 7.2, 7.4, 7.6, 7.7, 10.0
Authentication bypass via an alternate path/channel — an improper boot-time system process lets crafted HTTP requests run scripts/commands as root on the underlying OS
Exploitationyes — Cisco PSIRT, advisory last updated 2026-09-09: 'In August 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability.' CISA KEV added 2026-09-09, federal deadline 2026-09-12, known ransomware use: Unknown
KEV added2026-09-09
CISA deadline2026-09-12
Patched inHotfixes per train, from the Cisco advisory read 2026-09-11 — 7.0: GB-7.0.9.1-3 · 7.2: HL-7.2.11.1-4 · 7.4: HG-7.4.7.1-3 · 7.6: CY-7.6.5.1-2 · 7.7: AM-7.7.12.1-2 · 10.0: P-10.0.1.1-2. Cisco states there are NO workarounds that address this vulnerability — the hotfix is the only remediation
Heap-based buffer overflow (CWE-122) in the cw_acd daemon -> remote unauthenticated arbitrary code or command execution via crafted requests
Exploitationyes per CISA KEV (added 2026-09-09, federal deadline 2026-09-12, known ransomware use: Unknown). 🔴 VENDOR DISAGREES: FG-IR-25-084 states 'Known Exploited: No' — but its timeline ends 2026-02-23, so that is a February statement never revised after the September KEV listing. NVD also carries an Exploit-tagged third-party write-up of a FortiGate RAT ('PivotC2') built on this CVE, not read by this review
KEV added2026-09-09
CISA deadline2026-09-12
Patched inFortiOS 7.6.4+ (from 7.6.0-7.6.3) · 7.4.9+ (from 7.4.0-7.4.8) · 7.2.12+ (from 7.2.0-7.2.11) · 7.0.18+ (from 7.0.0-7.0.17) · FortiSwitchManager 7.2.7+ (from 7.2.0-7.2.6) and 7.0.6+ (from 7.0.0-7.0.5) — read from FG-IR-25-084 on 2026-09-11. 🔴 FortiOS 6.4: NO fixed build in-train, all versions affected, vendor instruction is 'Migrate to a fixed release'; the advisory timeline also records 6.4.17 being REMOVED from the fixed list on 2026-02-23. WORKAROUNDS (vendor, either one): (a) remove 'fabric' from allowaccess on each interface — config system interface / edit <port> / set allowaccess ssh https (dropping fabric); or (b) where fabric must stay, block CAPWAP-CONTROL UDP 5246-5249 via a local-in policy that accepts only trusted device addresses and denies all others. Follow Fortinet's upgrade-path tool at docs.fortinet.com/upgrade-tool
Citrix NetScaler ADC and NetScaler Gateway — 14.1 before 14.1-73.32; 13.1 before 13.1-63.21; NetScaler ADC FIPS before 14.1-73.32 FIPS; NetScaler ADC FIPS and NDcPP before 13.1-37.277
Authentication bypass using an alternate path or channel
Exploitationyes per CISA KEV (added 2026-09-09, federal deadline 2026-09-12, known ransomware use: Unknown). ⚠️ Citrix's bulletin CTX696939 does NOT mention in-the-wild exploitation — the exploitation claim rests on the KEV listing alone
KEV added2026-09-09
CISA deadline2026-09-12
Patched inFrom Citrix CTX696939, read 2026-09-11 — 14.1-73.32 and later · 13.1-63.21 and later · 14.1-73.32 FIPS and later · 13.1-37.277 and later (FIPS/NDcPP). Citrix states Workaround: None. Patching does not evict an attacker already in: on this product line, rotate credentials and terminate/invalidate existing sessions after upgrading
Google Chrome before 153.0.8010.36 (V8); every Chromium-based browser and Electron runtime embedding the affected V8 until independently rebuilt
Out-of-bounds write in V8 → arbitrary code execution inside the renderer sandbox via a crafted HTML page
Exploitationyes per CISA KEV (added 2026-09-09, federal deadline 2026-09-23, known ransomware use: Unknown). Google's Chrome Releases post was not readable per-CVE this session, so no vendor in-the-wild statement is recorded either way
KEV added2026-09-09
CISA deadline2026-09-23
Patched inChrome 153.0.8010.36 — from the CVE/CNA record read via the NVD API 2026-09-11 ('prior to 153.0.8010.36'). Force the update and RELAUNCH: a downloaded Chrome update does not protect a running browser. Other Chromium browsers and Electron apps need their own rebuild on a fixed V8; Chrome's update does not cover them ⚠️ SUPERSEDED AS THE DEPLOY TARGET 2026-09-18: Chrome 153.0.8010.52/.53 (desktop) and .52 (Linux/Android) of 2026-09-17 contains this fix AND two further CRITICAL memory-safety fixes (CVE-2026-93374 Dawn use-after-free, CVE-2026-93372 WebGL buffer overflow). Patching to exactly .36 clears this KEV deadline but leaves those two open — deploy .52/.53 instead.
Adobe Commerce 2.4.4–2.4.9 (2026-aug patch level and earlier), Adobe Commerce B2B 1.3.3 / 1.3.4 / 1.4.2 / 1.5.2 / 1.5.3 (2026-aug and earlier), Magento Open Source 2.4.6–2.4.9 (2026-aug and earlier) — all platforms
Improper neutralization of special elements used in a template engine (CWE-1336) → unauthenticated remote arbitrary code execution, scope changed. Unauthenticated per the vector (PR:N) — NVD's 'in the context of the current user' describes the resulting execution context, not a precondition
Exploitationyes — Adobe, APSB26-146 (published 2026-09-07, priority 1): 'Adobe is aware of CVE-2026-75650 being exploited in the wild'. CISA ADP vulnrichment 2026-09-08: Exploitation active / Automatable yes / Technical impact total. CISA KEV added 2026-09-08 (catalog v2026.09.08), federal deadline 2026-09-11, known ransomware use: Unknown. No actor or campaign named by Adobe
KEV added2026-09-08
CISA deadline2026-09-11
Patched inIsolated 'Hotfix for CVE-2026-75650' (Adobe priority 1) for every supported line, applied on top of the current 2026-aug patch level — NOT a new patch-level release; per the CNA record the hotfix is the only unaffected state. Installation: Experience League KB announcement for APSB26-146 (linked from the bulletin). No workaround published. Verify by confirming the hotfix is present, not by version number alone
N-able N-central, self-hosted — every build before 2026.3.1.14 (NVD: all < 2026.3, plus 2026.3 base, Hotfix 1, Hotfix 2, Hotfix 3); hosted N-central (NCOD) already patched by N-able, no customer action
Static code injection (CWE-96) → unauthenticated remote code execution on the N-central server
Exploitationyes per CISA — KEV added 2026-09-08 (catalog v2026.09.08, 'N-able N-central Static Code Injection Vulnerability'), federal deadline 2026-09-11, known ransomware use: Unknown. ⚠️ Vendor position as of the 2026-09-05 hotfix post: responsibly disclosed via the disclosure program, 'no confirmations that this vulnerability has been exploited in production environments, but unpatched systems remain at risk' — post RE-READ 2026-09-09 and UNCHANGED. CISA's listing three days later is the later and stronger claim and is what this card rests on, and it is corroborated upstream of KEV by the CISA-ADP SSVC block on the vendor's own CVE record, dated 2026-09-07: Exploitation active, Automatable yes, Technical Impact total. ⚠️ The commercial bulletin's claim that a fully patched N-central environment was compromised on 2026-09-04 is in neither vendor surface and is NOT asserted by this card
KEV added2026-09-08
CISA deadline2026-09-11
Patched inN-central 2026.3 Hotfix 4 = build 2026.3.1.14 (posted 2026-09-06, last updated 09-05; supersedes 2026.3 HF3 build 2026.3.1.13). Direct upgrade to 2026.3.1.14 from 2025.4 / 2026.1 / 2026.2 / 2026.3 / 2026.3 HF1 / HF2; older builds step to one of those first. Agents need no upgrade for this CVE. Hosted (NCOD) instances: no action, already patched. No workaround published on the reachable page
Microsoft Windows — Windows 11 Version 23H2, Windows 11 Version 24H2, Windows 11 Version 25H2, Windows 11 Version 26H1, Windows Server 2025 (MSRC affected-product list, 10 entries — Windows 11 23H2+ and Server 2025 ONLY; no Windows 10, no Server 2012–2022 entries). DISJOINT from CVE-2026-85880's footprint — zero products in common; no single machine needs both updates
Improper link resolution before file access (link following, CWE-59 class) in the Windows Update Stack → local elevation of privilege to SYSTEM
Exploitationyes — MSRC lists Exploited: Yes and Publicly Disclosed: No at release (2026-09-08T07:00 PT); CISA KEV added 2026-09-08 (catalog v2026.09.08, 'Microsoft Windows Link Following Vulnerability'), known ransomware use: Unknown. Microsoft names no actor or campaign
KEV added2026-09-08
CISA deadline2026-09-22
Patched inSeptember 2026 security update (MSRC release 2026-09-08): KB5122880 (Windows 11 Version 23H2); KB5124012 (Windows 11 Version 26H1); KB5122871 (Windows Server 2025); KB5124008 (Windows 11 Version 24H2, Windows 11 Version 25H2). No workaround published
Microsoft Windows — Windows 10 Version 1607, Windows 10 Version 1809, Windows 10 Version 21H2, Windows 10 Version 22H2, Windows Server 2012, Windows Server 2012 R2, Windows Server 2016, Windows Server 2019, Windows Server 2022 (MSRC affected-product list, 20 entries — Windows 10 1607→22H2 and Server 2012→2022 ONLY, incl. 2012 / 2012 R2 ESU; no Windows 11, no Server 2025 entries; DISJOINT from CVE-2026-81963's footprint — zero products in common, no single machine needs both updates)
Heap-based buffer overflow (CWE-122 class) in Windows Advanced Local Procedure Call (ALPC) → local elevation of privilege
Exploitationyes — MSRC lists Exploited: Yes and Publicly Disclosed: No at release (2026-09-08T07:00 PT); CISA KEV added 2026-09-08 (catalog v2026.09.08, 'Microsoft Windows Heap-Based Buffer Overflow Vulnerability'), known ransomware use: Unknown. Microsoft names no actor or campaign
KEV added2026-09-08
CISA deadline2026-09-22
Patched inSeptember 2026 security update (MSRC release 2026-09-08): KB5123066 (Windows Server 2012 R2); KB5123065 (Windows Server 2012); KB5123099 (Windows 10 Version 1607, Windows 10 Version 1607 for 32-bit Systems, Windows Server 2016); KB5122878 (Windows 10 Version 21H2, Windows 10 Version 21H2 for 32-bit Systems, Windows 10 Version 22H2, Windows 10 Version 22H2 for 32-bit Systems); KB5122882 (Windows Server 2022); KB5122876 (Windows 10 Version 1809, Windows 10 Version 1809 for 32-bit Systems, Windows Server 2019). No workaround published
Google Chrome (Desktop: Windows, Mac, Linux) before 152.0.7977.82 — V8 before 15.3.48; every Chromium-based browser and Electron runtime embedding the affected V8 until rebuilt
Type confusion in V8 (CWE-843) → arbitrary code execution inside the renderer sandbox via a crafted HTML page
Exploitationyes — Google, Stable Channel Update for Desktop 2026-09-03: 'Google is aware that an exploit for CVE-2026-85046 exists in the wild.' CISA KEV added 2026-09-04 (catalog v2026.09.04+), federal deadline 2026-09-18, known ransomware use: Unknown. No actor or campaign named
KEV added2026-09-04
CISA deadline2026-09-18
Patched inChrome 152.0.7977.82/.83 (Windows, Mac) and 152.0.7977.82 (Linux), Stable channel 2026-09-03, rolling out over days/weeks — force the update and RELAUNCH (a downloaded update does not protect a running browser). Other Chromium browsers: their own first build on V8 >= 15.3.48. No workaround
Kestra OSS — all versions < 1.0.45, and 1.1.0 – 1.3.20 (advisory range <= 1.3.20)
Authentication bypass via suffix-match path whitelist in AuthenticationFilter (CWE-287/184) → unauthenticated flow creation and execution → OS command injection (CWE-78) as root in the worker container
Exploitationyes per CISA — KEV added 2026-09-02, federal deadline 2026-09-05 (PASSED), known ransomware use: Unknown. The Kestra advisory (GHSA-5vc5-wxxq-3fjx, published 2026-06-03, reporter Vasco0x4) makes no exploitation statement
KEV added2026-09-02
CISA deadline2026-09-05
Patched inKestra 1.0.45 (1.0.x line) or 1.3.21 (1.1–1.3 line), per GHSA-5vc5-wxxq-3fjx. No vendor workaround published; until patched, block unauthenticated access to /api/ at the reverse proxy and require auth there, since the bypass lives inside the app's own filter
SonicWall SMA1000 (models 6210 / 7210 / 8200v) — SMA 100 Series and firewall SSL-VPN NOT affected
Pre-auth SSRF via unintended alternate access path acting as a forward proxy (CVE-2026-83548) chained with post-auth OS command injection in the Appliance Management Console (CVE-2026-83549) → remote code execution
Exploitationyes — SonicWall confirms active exploitation in the wild at disclosure (advisory SNWLID-2026-0016, 2026-09-01) and states the two flaws are being chained for RCE; corroborated by Sophos, Help Net Security and BleepingComputer reporting the same day. Also CISA KEV: both added 2026-09-02, federal deadline 2026-09-05 (PASSED; catalog v2026.09.22). SUPERSEDES this item's earlier evidence text, which was written against v2026.09.01 (before the listing) and stayed on the public card after the KEV flag was corrected
KEV added2026-09-02
CISA deadline2026-09-05
Patched in🔴 UPDATED 2026-10-12: go to 12.4.3-03670 or later, or 12.5.0-03082 or later (SNWLID-2026-0017, 2026-10-06). The September fixed builds for this pair (12.4.3-03526 / 12.5.0-02952) are named as AFFECTED by a NEW pre-auth SSRF, CVE-2026-102255 (CVSS 10.0, same Work Place interface; per the CVE record, 'affected: 12.4.3-03526 (platform-hotfix) and older versions' and '12.5.0-02952 (platform-hotfix) and older versions'). A September-patched appliance is exposed again. CVE-2026-102255 is NOT KEV-listed (v2026.10.08) and SonicWall reports no in-the-wild exploitation; honeypot operators reported probing from 2026-10-08 (see the CVE-2026-102255 item). History: the 03526 / 02952 builds were LATER than the July hotfixes for CVE-2026-15409/15410, so a July-patched appliance was still vulnerable to this pair. No vendor workaround published; restrict Work Place interface exposure to the internet in the interim
JFrog Artifactory Self-Managed — 7.111.4–7.111.20, 7.117.0–7.117.27, 7.125.0–7.125.19, 7.133.0–7.133.28, 7.146.0–7.146.37, 7.161.0–7.161.19 (union of JFrog's advisory table and NVD's CPE ranges; SaaS not addressed on the page)
Improper authentication (CWE-287) under default configuration → unauthenticated administrative access to Artifactory
Exploitationyes per CISA — KEV added 2026-09-02, federal deadline 2026-09-05 (PASSED), known ransomware use: Unknown. JFrog's advisory and release notes make no exploitation statement and name no actor
KEV added2026-09-02
CISA deadline2026-09-05
Patched inArtifactory Self-Managed 7.161.20 / 7.146.38 / 7.133.29 / 7.125.20 / 7.117.28 / 7.111.21, all released 2026-08-28 ('this patch includes security bug fixes … strongly recommended'); 7.161.24 (2026-09-05) is the current 7.161 build. No workaround published — restrict Artifactory's UI/API from the internet until patched
Sangoma Switchvox (SMB Edition; on-prem and cloud builds) — 8.2.2.1 through 8.4.0.1 per NVD; SRA tested 8.3 (build 104997)
Unauthenticated SQL injection (CWE-89) in the /pa phone-notification endpoint, executed as the PostgreSQL superuser → OS command execution via COPY … TO PROGRAM → remote code execution
Exploitationyes — Horizon3 (with Defused Cyber honeypots): valid exploitation attempts observed 2026-08-30, published 2026-09-01, same source IP across multiple honeypots, ~4,000 exposed devices on Shodan; CISA KEV added 2026-09-02 (catalog v2026.09.02+), federal deadline 2026-09-05 (PASSED), known ransomware use: Unknown. Sangoma's release notes make no exploitation statement
KEV added2026-09-02
CISA deadline2026-09-05
Patched inSwitchvox 8.4.0.2 (released 2026-07-14; release notes list CVE-2026-9586 'Unauthenticated RCE via SQL Injection' among the fixes, with CVE-2026-9585/9587/9588). Sangoma's 8.x upgrade notes call out hardware requirements and deprecated features to read before moving to any 8.x. No workaround published; keep the web interface off the internet regardless
BerriAI LiteLLM (proxy / AI gateway) — every version before 1.84.0, when MCP routes are enabled
Improper authentication / missing authentication (CWE-287, CWE-306) in the MCP auth handler's OAuth2 passthrough fallback → any Bearer token yields an authenticated MCP session → tool enumeration and invocation
Exploitationyes — Wiz Research ('AI infrastructure honeypot' blog): exploitation observed in Wiz honeypots, requests with single-character Bearer tokens (e.g. 'x') probing /v1/models and MCP endpoints; CISA KEV added 2026-09-02, federal deadline 2026-09-16, known ransomware use: Unknown. Wiz separately reports cryptominer drops via the related CVE-2026-42271 (KEV June 2026)
KEV added2026-09-02
CISA deadline2026-09-16
Patched inLiteLLM 1.84.0 or later (fix commit 73869f0, PR #26463). Vendor workaround if upgrade is not immediate: disable MCP routes, or block /mcp/ and related MCP endpoints at the reverse proxy or API gateway
Kludex Starlette (ASGI framework; underlies FastAPI and many Python services) — versions <= 1.0.0; also vendored/bundled copies (Red Hat errata RHSA-2026:22992/22993/23346/24866 and others)
Missing Host-header validation → request.url.path reconstructed from a malformed Host differs from the routed path → bypass of path-based security checks in middleware/endpoints (CWE-1289; request-smuggling class CWE-444)
Exploitationyes per CISA — KEV added 2026-09-02, federal deadline 2026-09-16, known ransomware use: Unknown. No public write-up of the exploitation is cited by NVD or the advisory; impact is application-specific (only apps that authorise on request.url are affected)
KEV added2026-09-02
CISA deadline2026-09-16
Patched inStarlette 1.0.1 or later (fix commit 764dab0; PYSEC-2026-161). For bundled copies, the distribution's errata (Red Hat: RHSA-2026:22992, 22993, 23346, 24866). Mitigation if pinned: enforce authorisation on the raw scope path (request.scope['path']) rather than request.url, and reject Host headers that are not a valid uri-host[:port]
Exploitationyes per CISA KEV (added 2026-08-31, deadline 2026-09-14, known ransomware use: Unknown). A Metasploit module targeting this issue is in the Rapid7 framework (PR 21842), so working exploit code is publicly available
KEV added2026-08-31
CISA deadline2026-09-14
Patched inPaperCut MF 26.0.5, Build 76602, released 2026-09-10 — read from PaperCut's MF 26.0 release history 2026-09-16, which states the release carries all fixes from the August 27 2026 Security Bulletin emergency patches and names this fix PO-4560. PaperCut also states the 25.0 line carries the same emergency-patch fixes; the exact 25.0 build was NOT read this session and is recorded as unverified rather than guessed
PaperCut MF and PaperCut NG — database connection utilities, specifically the external card/ID user lookup feature
Unsafe dynamic class loading — database driver classes instantiated from configurable driver names without validation
Exploitationyes per CISA KEV (added 2026-08-31, deadline 2026-09-14, known ransomware use: Unknown). A Metasploit module covering the August 2026 PaperCut issues is in the Rapid7 framework (PR 21842)
KEV added2026-08-31
CISA deadline2026-09-14
Patched inPaperCut MF 26.0.5, Build 76602, released 2026-09-10 — read from PaperCut's MF 26.0 release history 2026-09-16, fixes tracked as PO-4564 and PO-4575. ⚠️ REQUIRED FOLLOW-UP: the external database configuration for card/ID user lookups was hardened and moved into security.properties, and PaperCut states that organisations using external card/ID user lookup MUST reconfigure it per the setup instructions after upgrading — patching alone leaves that feature misconfigured. The exact 25.0-line build carrying the same fixes was NOT read this session and is not guessed here
WooCommerce Wholesale Lead Capture (Rymera Web Co Pty Ltd) — versions up to and including 2.0.3.1; approximately 6,000 active installations
Unrestricted upload of file with dangerous type — server honours client-supplied file-type settings instead of enforcing them server-side → PHP webshell upload → unauthenticated site takeover
Exploitationyes by evidence, no by catalog. Reporting describes more than 100,000 blocked exploitation attempts with activity surging 2026-06-04 to 2026-06-17 and returning 2026-07-01 and 2026-08-30; Patchstack badges the entry as known-exploited. ⚠️ CISA KEV v2026.09.14 does NOT list this CVE (checked directly against the local mirror), so the kev field is false — a vendor's badge is not the catalog
Patched inWholesale Lead Capture 2.0.3.2 or later — Patchstack advisory read 2026-09-16, which states the affected range as '<= 2.0.3.1' and the remedy as 'Update to version 2.0.3.2 or later'. (The Patchstack URL slug reads 'plugin-1-17-8', which is a stale slug and not the affected range.) Post-compromise: inspect upload directories for unexpected PHP files, review administrator accounts, server logs, checkout changes and scheduled tasks, search for secondary backdoors, remove confirmed malicious files/accounts, reset privileged passwords and verify backups predate compromise before restoring
improper authentication (CWE-287) → unauthenticated file read/write/delete over WebDAV
Exploitationyes — used against a Philippine nuclear research organisation; investigators recovered the operator's staging server with tooling, transfer logs and the stolen files. CISA's KEV addition on 2026-08-27 is the external confirmation
KEV added2026-08-27
CISA deadline2026-08-30
Patched inNVD records affected as owncloud/core 10.6.0 up to (not including) 10.13.1 — 10.13.1 is the fixed version. The reporting research advises 10.13.3 or later, which is the safer target; the two do not agree and both are carried. SECOND, NON-OPTIONAL STEP: configure a signing key — the bypass only reaches accounts that have none
Linux kernel (IPv6 networking subsystem, __ip6_append_data). CISA notes this affects multiple downstream products including SUSE and Red Hat
out-of-bounds write / heap overflow (CWE-787, CWE-122) → local privilege escalation → container escape to host root
Exploitationyes — a public exploit was retrieved and customised by model-driven agents on 2026-07-19 to escape an Artifactory container to root on a Kubernetes worker node, per OpenAI's published incident technical report
KEV added2026-08-27
CISA deadline2026-08-30
Patched inNVD records fixed in 6.1.177, 6.6.144, 6.12.95, 6.18.38 and 7.1.3; affected from 6.0. Take your distribution's errata rather than mapping upstream versions by hand — SUSE and Red Hat are named in CISA's own note
improper limitation of a pathname to a restricted directory (CWE-22) → write outside the Docker cache path → container-image cache poisoning (execution was the aim, not observed)
Exploitationyes — exploited as a zero-day beginning 2026-07-09 by model-driven agents inside OpenAI's evaluation environment, to poison a trusted container image in Artifactory's cache (substitution confirmed; no pull or execution observed), per OpenAI's incident technical report §V, which states this activity did not contribute to the Hugging Face compromise. CORRECTED 2026-09-24: earlier text tied this CVE to that compromise and claimed execution; the cited report says neither
KEV added2026-08-27
CISA deadline2026-09-10
Patched inNVD records affected as Artifactory self-managed before 7.146.35, and 7.161.0 up to (not including) 7.161.16 — update to 7.146.35 or 7.161.16 as appropriate to your line. JFrog's SaaS offering is a separate product and was not the affected instance in the reported incident
Ajax.NET Professional (AjaxPro.2 all versions; <21.10.30.1) · Red Hat ABRT <2.7.1 (RHEL 6/7, Oracle Linux 7) · Linux kernel 5.8–5.10.105, 5.11–5.15.28, 5.16–5.16.4, 5.17-rc (incl. NetApp H-series) · Red Hat libuser <0.56.13-8 and 0.60 <0.60-7
Untrusted deserialization → RCE (23758); symlink attack on a predictable filename → local privilege escalation (5287); watch_queue out-of-bounds write → local privilege escalation (0995); direct /etc/passwd modification via userhelper → inconsistent file state, race condition per CISA (3246)
Exploitationyes — all four added to CISA KEV on 2026-08-26 on the basis of confirmed in-the-wild exploitation; ransomware use: Unknown for all four
KEV added2026-08-26
CISA deadline2026-09-09
Patched inAjax.NET Professional 21.10.30.1+ · ABRT 2.7.1+ (Red Hat's 2015 advisory packages) · Linux kernel per distribution advisories (5.10.106+, 5.15.29+, 5.16.5+ or backported vendor kernels) · libuser 0.56.13-8 and 0.60-7 or later. Also patch CVE-2015-3245 alongside CVE-2015-3246 — it is the other half of the documented privilege-escalation combination even though it carries no KEV deadline
Citrix NetScaler ADC and NetScaler Gateway 14.1 <72.61, 13.1 <63.18; NetScaler ADC 13.1-FIPS/NDcPP <37.272 and 14.1-FIPS <72.61 — only when configured as a Gateway (VPN vserver, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server
Memory overflow (improper restriction of operations within the bounds of a memory buffer) → unpredictable behaviour / denial of service
Exploitationyes — CISA KEV-confirmed (added 2026-08-26, ransomware use: Unknown). Citrix disclosed the flaw in June 2026; KEV membership is the exploitation evidence carrying this card
KEV added2026-08-26
CISA deadline2026-08-29
Patched inNetScaler ADC and NetScaler Gateway 14.1-72.61, 13.1-63.18, 13.1-FIPS/NDcPP 37.272, 14.1-FIPS 72.61 and later. No workaround published — the only mitigation short of upgrading is removing the Gateway/AAA virtual server role, which is normally the reason the appliance exists
Gitea — versions 1.17 through 1.27.0 inclusive; requires Git 2.32 or newer on the host
Improper access control in the diffpatch API → add/add collision writes hooks/post-index-change in a bare clone → remote code execution as the Gitea service account
Exploitationyes per CISA KEV (added 2026-08-25, deadline 2026-08-28, known ransomware use: Unknown). Public reporting describes an active campaign scanning ~1,386 internet-facing servers with confirmed victims in Canada, Argentina, Taiwan, the United States and Sri Lanka, deploying the JITTERLY Linux implant and the SIXZUT LD_PRELOAD rootkit
KEV added2026-08-25
CISA deadline2026-08-28
Patched inGitea 1.27.1, released 2026-07-27 (GitHub Security Advisory + Gitea 1.27.1 release notes, read 2026-09-16). The advisory recommends no mitigation other than upgrading; operationally, disabling open registration removes the unauthenticated path to the required write access but does NOT fix the flaw for authenticated users. Post-compromise: rotate all passwords, tokens, SSH keys and application secrets held on the instance
Microsoft Windows — Internet Key Exchange (IKE) Service Extensions
Double free (CWE-415) in the Windows IKE Extension → unauthenticated remote code execution over the network
Exploitationyes — CISA KEV listing (CISA adds only confirmed actively-exploited flaws). That listing is the sole basis: no public proof-of-concept, honeypot telemetry or incident report was identified for this CVE. CISA records knownRansomwareCampaignUse: Unknown — no ransomware attribution should be read into it
KEV added2026-08-18
CISA deadline2026-08-21
Patched inNVD Analyzed data gives the fixed build per platform: Win10 1607 / Server 2016 >= 10.0.14393.9060; Win10 1809 / Server 2019 >= 10.0.17763.8644; Win10 21H2 >= 10.0.19044.7184; Win10 22H2 >= 10.0.19045.7184; Win11 23H2 >= 10.0.22631.6936; Win11 24H2 >= 10.0.26100.8246; Win11 25H2 >= 10.0.26200.8246; Win11 26H1 >= 10.0.28000.1836; Server 2022 >= 10.0.20348.5020; Server 2022 23H2 >= 10.0.25398.2274; Server 2025 >= 10.0.26100.32690. Interim mitigation only: restrict UDP/500 and UDP/4500 to known peers, or remove the responder from the public internet
Broadcom/VMware — vCenter Server, and the Cloud Foundation / vSphere Foundation / Telco Cloud Infrastructure and Platform lines that embed it (VMSA-2026-0006)
Directory traversal in the vCenter Syslog Server (CWE-22) — an actor with network access to vCenter may execute arbitrary code
Exploitationyes — CISA KEV listing (CISA adds only confirmed actively-exploited flaws). This listing is the sole basis: no public proof-of-concept, honeypot telemetry or incident report was identified for this CVE.
KEV added2026-08-18
CISA deadline2026-08-21
Patched invCenter 9.1.0.0300, 9.0.2.0100, 8.0 U3k and the corresponding Cloud Foundation / vSphere Foundation / Telco Cloud releases per VMSA-2026-0006 — the same fixed versions as the rest of the advisory
Microsoft — SharePoint Server 2016 / 2019 / Subscription Edition (on-premises only; SharePoint Online not affected)
Weak authentication (CWE-1390) — forged JWT via alg:none + x5t certificate reference + trusted-service bypass → impersonation of any site user or administrator
Exploitationyes — Defused honeypot telemetry reports exploitation from 2026-08-12, roughly a day after Rapid7 published the technical analysis and PoC (2026-08-11); CISA warned administrators about this CVE on 2026-07-15
KEV added2026-08-18
CISA deadline2026-08-21
Patched inJuly 2026 security updates — Enterprise Server 2016 >= 16.0.5561.1001, Server 2019 >= 16.0.10417.20175, Subscription Edition >= 16.0.19725.20434. Interim: remove on-prem servers from direct internet exposure.
Microsoft Windows Ancillary Function Driver for WinSock (afd.sys) — Windows 10 1607/1809/21H2/22H2, Windows 11 23H2/24H2/25H2/26H1, Windows Server 2012 / 2012 R2 / 2016 / 2019 / 2022 / 2025 (x64, x86, ARM64)
Use-after-free race condition in a kernel-mode network driver → local privilege escalation to SYSTEM
Exploitationyes — CISA KEV-confirmed (added 2026-08-11, ransomware use: Unknown). Microsoft's patch and the KEV listing landed the same day, indicating exploitation preceded the fix
KEV added2026-08-11
CISA deadline2026-08-25
Patched inAugust 2026 Windows cumulative updates. CRITICAL CAVEAT: the fix does not take effect until the machine REBOOTS — afd.sys is a loaded kernel driver. Track compliance against pending-reboot state, not update-installed state
Authentication bypass via alternate path or channel (CWE-288) → unauthenticated admin console takeover; CVE-2026-18577 is an incomplete patch for CVE-2026-18556
Exploitationyes — CISA confirmed active exploitation for both (KEV adds 2026-08-03 and 2026-08-04); reporting describes abuse of the Take Control feature to pivot into managed endpoints and Cloudflare tunnels for persistence. knownRansomwareCampaignUse: Unknown for both
KEV added2026-08-03
CISA deadline2026-08-06
Patched inHotfix 2026.3.1.7, released 2026-08-02. NVD affected ranges differ: CVE-2026-18556 through 2026.1; CVE-2026-18577 through 2026.3.1. Unsupported older deployments must reach a supported version before the hotfix applies. MFA does NOT mitigate — an auth bypass never reaches the MFA step
Microsoft — SharePoint Enterprise Server 2016 / Server 2019 / Subscription Edition (on-premises)
Deserialization of untrusted data (CWE-502) → unauthenticated remote code execution; observed follow-on theft of SharePoint machine keys for persistence that survives patching
Exploitationyes — CISA KEV listing (CISA adds only confirmed actively-exploited flaws); reporting attaches subsequent machine-key theft used to retain access after patching, and Swiss BIT/FOITT named it as a suspected vector in its ~200-account credential compromise
KEV added2026-07-22
CISA deadline2026-07-25
Patched inJuly 2026 security updates — Enterprise Server 2016 >= 16.0.5561.1001, Server 2019 >= 16.0.10417.20175, Subscription Edition >= 16.0.19725.20434. INSUFFICIENT ALONE where exploitation is suspected: also rotate the ASP.NET machine keys and restart IIS.
Check Point — Security Management Server and Multi-Domain Security Management Server (MDS)
Authentication bypass — attacker-supplied SIC distinguished name accepted in place of the authenticated peer certificate identity (CWE-287)
Exploitationyes — CISA KEV-confirmed (added 2026-07-22, ransomware use: Unknown); Check Point states it is aware of exploitation affecting 'a very small number of customers', who were notified directly; Rapid7 Labs confirmed in-the-wild exploitation as a zero-day at disclosure and published a working PoC
KEV added2026-07-22
CISA deadline2026-07-25
Patched inJumbo Hotfix Accumulator: R82.10 Take 36+, R82 Take 118+, R81.20 Take 158+ (Rapid7 confirmed R81.20 Take 146 vulnerable, Take 158 fixed). Affected list also includes R77.30, R80, R80.10, R80.20, R80.30, R81, R81.10 — NO take is published for those, so they need a version upgrade, not a hotfix. Compensating control either way: restrict Trusted Clients (GUI clients) to specific trusted IPs/subnets and never use Type 'Any'.
REST API batch endpoint route confusion (CWE-436) chained with WP_Query author__not_in SQL injection (CWE-89) → unauthenticated RCE
Exploitationyes — CISA confirmed active exploitation in the wild for both CVEs (added to KEV 2026-07-21); knownRansomwareCampaignUse: Unknown for both
KEV added2026-07-21
CISA deadline2026-07-24
Patched inFixed in WordPress 6.8.6, 6.9.5, and 7.0.2 — affected: 6.8.x <6.8.6, 6.9.x <6.9.5, 7.0.x <7.0.2. Core upgrade is necessary but not sufficient: audit plugins/themes passing untrusted input into the WP_Query author__not_in parameter
Pre-auth wsproxy bypass (CVE-2026-15409) chained with code injection (CVE-2026-15410) and removehotfix path traversal → unauthenticated root
Exploitationyes — CISA confirmed active exploitation (KEV 2026-07-14), knownRansomwareCampaignUse: KNOWN for both; 2026-08-03 reporting attributes the full chain to the INC Ransomware group and states exploitation preceded patch availability
KEV added2026-07-14
CISA deadline2026-07-17
Patched inHotfixes for affected 12.4.3 / 12.5.0 releases (no workaround available). An internet-facing appliance unpatched during the exposure window should be treated as compromised: factory reset and rebuild, then rotate all credentials, certificates, API keys, and TOTP secrets handled by the device
Microsoft — SharePoint Enterprise Server 2016 / Server 2019 / Subscription Edition (on-premises)
Missing authentication for critical function (CWE-306) → unauthenticated privilege escalation over the network
Exploitationyes — CISA KEV listing (CISA adds only confirmed actively-exploited flaws); named by Swiss BIT/FOITT as a suspected vector in the intrusion that compromised ~200 accounts, which is the agency's stated belief rather than a confirmed root cause
KEV added2026-07-14
CISA deadline2026-07-17
Patched inJuly 2026 security updates — Enterprise Server 2016 >= 16.0.5561.1001, Server 2019 >= 16.0.10417.20175, Subscription Edition >= 16.0.19725.20434
PTC Windchill PDMLink and FlexPLM (releases prior to 11.0 M030)
Deserialization of untrusted data (CWE-502/CWE-20) → unauthenticated RCE → JSP webshell → data theft + extortion
Exploitationyes — CISA-confirmed active exploitation, knownRansomwareCampaignUse: Known; assessed exploited as a zero-day from early June 2026, prior to the June 17 disclosure
KEV added2026-06-25
CISA deadline2026-06-28
Patched inPTC advisory June 2026; fixed in 11.0 M030 and later. Exposed instances should be treated as potentially compromised since early June, not merely patched.
Oracle PeopleSoft Enterprise PeopleTools 8.61 and 8.62 (component: Updates Environment Management / PSEMHUB) — exposure requires PSEMHUB deployed and reachable
CWE-306 missing authentication for a critical function — unauthenticated takeover via Java deserialization in the PSEMHUB hub servlet (per GTIG)
Exploitationyes — zero-day exploitation 2026-05-27..06-09 and a renewed mass campaign reported 2026-09-25, both attributed by GTIG/Mandiant to UNC6240 (ShinyHunters); CISA KEV (added 2026-06-12, known ransomware campaign use: Known)
KEV added2026-06-12
CISA deadline2026-06-15
Patched inOracle Security Alert for CVE-2026-35273 (out-of-band, 2026-06-10) — patch IDs not read (Oracle page 403 to automation; get them from the alert / My Oracle Support). GTIG: WAF rules and path-based blocking are not a substitute for patching. Compensating: disable the EMHub service (multi-server) or remove PSEMHUB (single-server); keep PSEMHUB and PSIGW off the internet; block on the NORMALIZED path; hunt for extra .jsp/.jspx/.exe under PSEMHUB.war and PORTAL.war; alert on shells spawned by WebLogic; rotate psappsrv.cfg database, Integration Broker and cloud credentials
Exploitationyes per CISA KEV (added 2026-06-08, deadline 2026-06-11) and CISA records KNOWN RANSOMWARE CAMPAIGN USE = Known for this CVE
KEV added2026-06-08
CISA deadline2026-06-11
Patched inCheck Point published sk185033 and a hotfix for the deprecated IKEv1 protocol (vendor advisory and Check Point blog post, referenced from NVD 2026-09-16). ⚠️ The specific hotfix take/build numbers were NOT read in full this session and are deliberately not stated here — consult sk185033 for the per-version take. Because the flaw is in the DEPRECATED IKEv1 exchange, disabling IKEv1 where it is not required removes the exposed surface without a patch window and should be checked first
Exploitationyes — CISA-confirmed active exploitation, knownRansomwareCampaignUse: Known; Rapid7 observed in-the-wild exploitation from 2026-05-17; Arctic Wolf documented multiple June 2026 Qilin intrusions
KEV added2026-05-29
CISA deadline2026-06-01
Patched inFixed by Palo Alto Networks 2026-05-13 — see vendor advisory; mitigation note: exploitation requires authentication override cookies enabled with specific certificate configurations
Linux kernel — algif_aead (AF_ALG crypto user-space interface). Fixed across stable trees; distribution kernels inherit the fix via their own stable-tree rebases
Incorrect resource transfer between spheres (CWE-669, also CWE-1288) in algif_aead — in-place operation across distinct source/destination mappings; upstream fix reverts to out-of-place operation. Local privilege escalation
Exploitationyes — CISA KEV added 2026-05-01, federal deadline 2026-05-15 (EXPIRED), known ransomware use: Unknown. NVD additionally carries an oss-security post tagged 'Exploit' (2026-04-29). Independently, the KATARU IoT botnet described elsewhere in this brief attempts this CVE for privilege escalation after credential brute-force
KEV added2026-05-01
CISA deadline2026-05-15
Patched inFixed upstream in the Linux stable trees — NVD lists eight stable-tree patch commits (git.kernel.org/stable/c/ 19d43105, 3115af96, 893d22e0, 8b88d993, 961cfa27, a664bf3d, ce42ee42, fafe0fa2), read via the NVD API 2026-09-11. There is no single version number: take your distribution's current kernel, which carries the fix through its stable rebase. ⚠️ No specific distribution package versions were verified by this review — confirm against your own vendor's errata. Hardening that reduces exposure regardless: AF_ALG is rarely needed by applications, so blocking the algif_aead module or restricting AF_ALG socket creation removes the attack surface on hosts that do not use it
WebPros — cPanel & WHM (including DNSOnly) and WP2 / WordPress Squared. Affected: ALL versions after 11.40
CWE-306 missing authentication for a critical function — authentication bypass in the cPanel login flow granting unauthenticated remote access to the control panel; public exploit chain to RCE
ExploitationYES, and long-running. CISA KEV added 2026-04-30, federal deadline 2026-05-03 (PASSED ~5 months), knownRansomwareCampaignUse: Known. Mass-exploited in ransomware attacks per BleepingComputer reporting; watchTowr Labs published an exploitation analysis and a public PoC repository (auth bypass to RCE). Renewed September 2026 activity reported as Mirai-style botnet recruitment against still-unpatched servers — that later activity is secondary-tier (bulletin narrative + traffic observation), while the KEV listing, ransomware flag and public exploit are primary
KEV added2026-04-30
CISA deadline2026-05-03
Patched inRead from the cPanel security advisory on 2026-09-23. Patched cPanel & WHM builds: 11.86.0.41+, 11.94.0.28+, 11.102.0.39+, 11.110.0.97+, 11.118.0.63+, 11.124.0.35+, 11.126.0.54+, 11.130.0.19+, 11.132.0.29+, 11.134.0.20+, 11.136.0.5+. WP Squared: 136.1.7+. CentOS 6 / CloudLinux 6 on v110.0.50: update to v110.0.103 (set tier via cpupdate.conf). All later cPanel versions are patched. ACTIONS: run /scripts/upcp --force, verify with /usr/local/cpanel/cpanel -V, then /scripts/restartsrv_cpsrvd --hard. CRITICAL RESIDUAL: servers with cPanel updates disabled or pinned to a specific version DID NOT auto-update and must be found and patched manually. Given KEV ransomware status and 5 months of exposure, assume possible compromise and investigate rather than only patching; cPanel published a detection script with the advisory
Fortinet FortiClient EMS 7.4.5 through 7.4.6. Not affected: 7.2, 8.0
Improper access control — unauthenticated execution of unauthorized code or commands via crafted API requests
Exploitationyes — Fortinet FG-IR-26-099 (2026-04-04): 'observed this to be exploited in the wild'; CISA KEV added 2026-04-06, ransomware use Unknown. Public PoC since 2026-04-04/06 (GitHub; Tenable 2026-04-06). Not newly confirmed in October — the bulletin's framing is corrected here
KEV added2026-04-06
CISA deadline2026-04-09
Patched inFortiClient EMS 7.4.7 or later, or the vendor hotfix for 7.4.5 / 7.4.6 (FG-IR-26-099, read by a research subagent 2026-10-15; affected range re-read in the CVE record). 7.2 and 8.0 not affected. Restrict EMS management access to trusted networks
Improper control of dynamically-managed code resources (CWE-913) in workflow expression evaluation → authenticated RCE as the n8n process
Exploitationyes — CISA KEV listing establishes confirmed in-the-wild exploitation (added 2026-03-11); knownRansomwareCampaignUse: Unknown, which is not a statement that exploitation is absent
KEV added2026-03-11
CISA deadline2026-03-25
Patched inFixed in n8n 1.120.4 / 1.121.1 / 1.122.0 (GHSA-v98v-ff95-f3cp). Upgrading to 2.31.5 or 2.32.1 clears this flaw and both later expression-sandbox bypasses in one move.
Meta React Server Components (react-server-dom-webpack / -turbopack / -parcel 19.0.0, 19.1.0, 19.1.1, 19.2.0) and Vercel Next.js 15.0.0–16.0.7 incl. canary builds
Unsafe deserialization of HTTP request payloads at Server Function endpoints → pre-authentication remote code execution
Exploitationyes — CISA KEV-confirmed with knownRansomwareCampaignUse: Known. The DFIR Report documents it as the initial-access vector exploited by EtherRAT in intrusions that end in The Gentleman ransomware, with TukTuk deployed as the follow-on framework
KEV added2025-12-05
CISA deadline2025-12-12
Patched inUpgrade the affected react-server-dom-* packages and Next.js past the fixed releases named in the Meta and Vercel advisories. There is no workaround for an exposed Server Function endpoint short of removing its reachability
RARLAB WinRAR for Windows, up to and including 7.12
Path traversal in archive extraction — a crafted RAR writes a payload outside the extraction folder (here the Startup folder), giving code execution at next sign-in; user must open the archive
Exploitationyes — exploited in the wild per ESET (CNA record); CISA KEV added 2025-08-12, known ransomware campaign use; Talos (2026-10-14) documents UAT-6275 use against CIS government targets (chain D, April 2026)
KEV added2025-08-12
CISA deadline2025-09-02
Patched inWinRAR 7.13 or later (CVE record: affected up to 7.12, read directly 2026-10-15; RARLAB release page not re-read this session). Patching does not remove PickleShell — hunt Startup folders, scheduled tasks, PowerShell downloaders
SonicWall SMA100 series (SMA 200/210/400/410/500v, firmware ≤10.2.1.9-57sv) AND Apache HTTP Server 2.4.0–2.4.59 — the Apache half is exploitable wherever it runs, not only inside the appliance
mod_rewrite output-escaping flaw → unintended filesystem mapping and admin session-token hijack (CVE-2024-38475), chained into authenticated OS command injection as 'nobody' (CVE-2023-44221) → unauthenticated arbitrary command execution
Exploitationyes — both CISA KEV-listed (added 2025-05-01, ransomware use: Unknown for both); SonicWall confirmed the two flaws are exploited together in the wild and security researchers publicly documented the full chain
KEV added2025-05-01
CISA deadline2025-05-22
Patched inSonicWall SMA100 firmware 10.2.1.10-62sv and above; Apache HTTP Server 2.4.60 and above. Neither vendor published a workaround beyond upgrading. SMA100 administrators should additionally review for unauthorized logins and rotate admin credentials — the chain grants full device compromise, so a patch alone does not establish that the device is clean
Fortinet FortiOS 7.0.0–7.0.16; FortiProxy 7.0.0–7.0.19 and 7.2.0–7.2.12
Authentication bypass via an alternate path in the Node.js websocket module (CWE-288) → super-admin privileges on the device
Exploitationyes — CISA KEV with knownRansomwareCampaignUse: Known; disclosed by Fortinet as an actively exploited zero-day in January 2025 with rogue admin account creation observed for weeks prior; subsequently tied by CISA and partners to ransomware intrusions including an August 2026 advisory on the Gunra campaign using compromised FortiGate devices for initial access
KEV added2025-01-14
CISA deadline2025-01-21
Patched inFortiOS 7.0.17 and above; FortiProxy 7.0.20 or 7.2.13 and above. No vendor workaround. Any device whose management interface was internet-exposed should have admin credentials rotated — the patch closes the bypass but does not evict an attacker who already created accounts
Atlassian Confluence Data Center and Server 8.0.0 through 8.5.1. Versions prior to 8.0.0 are NOT affected. Atlassian Cloud sites (accessed via an atlassian.net domain) are NOT affected
Broken access control reachable pre-auth on the /setup/* endpoints — permits creation of an unauthorized account in the confluence-administrators group
Exploitationyes — on CISA KEV since 2023-10-05 with known ransomware campaign use: Known. Still in active use for initial access: BI.ZONE reports exploitation of an internet-facing Confluence instance in the Feral Wolf / GenieLocker intrusion set running May-August 2026. ⚠️ The BI.ZONE report was NOT read this session; the 2026 campaign attribution rests on secondary coverage. The KEV listing and ransomware flag were read from the local catalog mirror v2026.09.18
KEV added2023-10-05
CISA deadline2023-10-13
Patched inConfluence Data Center and Server 8.3.3, 8.4.3, or 8.5.2 (LTS) or later, per Atlassian's advisory read 2026-09-18. Limited mitigation where upgrade is not immediately possible: block /setup/* in web.xml — Atlassian states this is 'limited and not a replacement for upgrading'. ⚠️ PATCHING IS NOT EVICTION: this has been exploited since October 2023, so hunt for the vendor's IoCs (unexpected confluence-administrators members, new user accounts, unknown plugins, /setup/*.action in network logs, /setup/setupadministrator.action in security-log exceptions) rather than assuming the upgrade closed the incident
Progress MOVEit Transfer (all before 2021.0.7; 2021.1.0–2021.1.4; 2022.0.0–2022.0.4; 2022.1.0–2022.1.5; 2023.0.0–2023.0.1) and MOVEit Cloud ≤14.1.6.97 / ≤15.0.2.38
Unauthenticated SQL injection in the MOVEit Transfer web application → database access, then web shell deployment and mass exfiltration
Exploitationyes — CISA KEV with knownRansomwareCampaignUse: Known. Exploited as a zero-day from late May 2023 by Clop; EPSS remains near 1.0 three years later, indicating sustained exploitation attempts against surviving unpatched instances
KEV added2023-06-02
CISA deadline2023-06-23
Patched inPatched MOVEit Transfer releases from 2023-05-31 onward; no interim workaround was published. Secondary and non-optional: any instance that ran unpatched past May 2023 should be handled as a possible prior compromise — rotate credentials and conduct a forensic review rather than assuming the upgrade is sufficient